=== Zenic Pay for WooCommerce ===
Contributors: zenicpay
Tags: woocommerce, payment gateway, bkash, nagad, Bangladesh
Requires at least: 6.5
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Brand Secret Key দিয়ে connect করুন। Classic এবং Block checkout-এ bKash, Nagad, Rocket ও Upay hosted payments.

== Installation ==
1. WordPress → Plugins → Add New → Upload Plugin → select zenic-pay-woocommerce-1.1.0.zip → Install → Activate.
2. WooCommerce → Settings → Payments → Zenic Pay → Manage.
3. Zenic Pay → Brands → Secret Key থেকে আপনার store-এর Brand Secret Key (zps_live_…) paste করুন। Enable checked রেখে Save changes চাপুন।
4. Connected দেখালে checkout ready. Webhook URL / signing secret নিজে setup করতে হবে না।

Your WooCommerce currency must be BDT and your website must use HTTPS. The domain, including www, must match your Zenic Pay Brand website. WordPress installed in a subdirectory is supported. A valid Zenic Pay plan/trial, active receiving gateways and an SMS-connected phone are required for payment verification.

== Payment behavior ==
Customers are redirected to Zenic Pay to choose from their Brand's enabled providers. The customer returns to the WooCommerce order-received page after verification. Browser redirects never prove payment. Signed webhooks complete the order after checking the saved reference, token, payable amount and currency. WordPress also reconciles pending payments with the authenticated Zenic Pay status API.

WooCommerce handles stock, emails and download access via payment_complete(). Physical orders normally become Processing; virtual/downloadable orders follow WooCommerce rules. Duplicate callbacks do not complete the order twice. Refunds are manual: this plugin does not move money back to customers.

Do not modify an unpaid order's amount after opening its checkout. If a session expired, check the old payment first and create a new order if needed. This prevents replacing a possibly paid reference.

== Background checks ==
Action Scheduler checks first every minute, then every 10 minutes, for about 23 hours. Webhooks remain available beyond that. Configure a real server cron to run WP cron regularly for low-traffic stores. The order Actions menu includes “Zenic Pay: Check payment status”.

== External service and data ==
This plugin connects to https://zenicpay.com over HTTPS. Setup sends your Brand Secret Key, callback URL and a locally generated signing secret. Checkout sends order reference, amount and return URL. No billing name/email/phone is sent by this version. Status checks send the Brand Secret Key and checkout token. Keys and webhook secrets are stored server-side in WordPress options, never in customer JavaScript. Protect your database backups.

Service terms: https://zenicpay.com/terms
Privacy: https://zenicpay.com/privacy
Support: https://wa.me/8801522128426

== Troubleshooting ==
* Not connected: check Brand Secret Key, HTTPS and exact registered domain.
* Pending: check Zenic Pay SMS app internet, device connection and received payment. Do not pay twice.
* Webhook not delivered: allow HTTPS POST requests to /?wc-api=zenic_pay through your firewall/cache plugin. Exclude wc-api and checkout/order pages from full-page caching.
* WordPress cron stopped: webhook can still complete payments; scheduled reconciliation resumes once cron works.
* Invalid key after rotation: reconnect using the new Brand Secret Key.
* Disable: uncheck Enable in gateway settings. Existing pending payments can still reconcile.
* Uninstall: order audit metadata and connection settings are retained to avoid losing reconciliation. Disable the WooCommerce endpoint from Zenic Pay Developer Integration before permanently removing the store.

== Changelog ==
= 1.1.0 =
* Uses the server-only Brand Secret Key (zps_live_…) for store connection, checkout and status checks. The public Brand Key still works while the Brand's migration setting allows it.

= 1.0.0 =
Brand-key setup, domain binding, scoped signed webhooks, HPOS order access, classic/block checkout, duplicate protection, status recovery and responsive admin settings.
